In Connecticut, a person commits a computer crime if there is any violation of the provisions in Connecticut General Statutes 53a-251. This is Connecticut’s computer crime statute. The statute defines criminal conduct under the following categories:
- Unauthorized access to a computer system
- Theft of computer services
- Interruption of computer services
- Misuse of computer system information
- Destruction of computer equipment
The computer crime statute itself does not provide for a civil cause of action. Instead, a victim of a computer crime may rely on Connecticut General Statutes 52-570b, which permits a civil lawsuit for computer-related offenses. The statute provides a basis for a lawsuit for "an aggrieved person who has reason to believe that any other person has been engaged, is engaged or is about to engage in" conduct that violates the computer crime statute.
As part of a computer crime lawsuit, a business may seek a temporary or permanent injunction, restitution, actual damages, unjust enrichment, an order to appoint a receiver who may take property into his possession, or any other equitable relief. Punitive damages may be available if there is a showing of malicious or willful conduct. Further, a victim of computer crime may obtain an award of attorney’s fees and costs.
One of the more common types of computer crime or cyber attack is an insider attack with unauthorized access to a computer network. A common example is a disgruntled employee or vendor with some level of access to the computer network of a business that turns into unauthorized use or damaging conduct. The cyber attack might involve theft of confidential or proprietary information, installing a virus or malicious code to infect the system, or theft and disclosure of information to third parties.
The most common defense raised to computer crime charges is "authorized access." The statute exempts conduct that might qualify as improper, but was undertaken with a reasonable belief that it was authorized. As such, the issue of authorization becomes a critical element in these cases. Courts might look to the policies and practices of a business with respect to access and security to determine if a reasonable belief defense exists. Courts will also look to the nature of the conduct to determine if a reasonable belief defense is legitimate under the circumstances of the case.
Responding quickly to a computer crime or cyber attack is important. A business that is the victim of a computer crime or cyber attack should consider involving an attorney as part of the response team depending on the severity of the incident. The attorney can assess whether a business that is victim of a computer crime can bring a lawsuit to recover damages or possibly make a claim for losses to an insurance company. An attorney can also assist with critical decision making regarding notification to outside parties in the case of a security breach or data loss. An attorney can further assist with determining the need for involvement of an appropriate forensic expert to preserve and develop critical electronic evidence of the cyber attack.